-
Notifications
You must be signed in to change notification settings - Fork 107
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unobfuscate plugin code #53
Comments
@samuelmaddock - sorry about the delay - we are looking into this now. |
Hi Samuel, this is an artifact from way back in the Omniture days when consulting helped with implementations and used these plugins extensively. With how easy it is to deobfuscate code and the open-source nature of the docs, it would indeed make more sense to open these up to improvements. At the same time, it acts as a deterrent against people screwing up the plugin, producing undesirable results. |
@gigazelle I can somewhat understand why obfuscation is used here, however, I believe the use of I'd suggest using minified code such as the example I posted for the |
Hi @samuelmaddock , I've spent the last couple weeks working with consulting and getting each plug-in up to snuff. You'll find that every plug-in should meet your requirements now. Thank you for your feedback! https://docs.adobe.com/content/help/en/analytics/implementation/vars/plugins/impl-plugins.html |
Thanks @gigazelle! Your work is appreciated 🙂 I did find one instance which looks like was missed under the Installed Plug-ins section. s.getQueryParam=new Function("qp","d",""
+"var s=this,v='',i,t;d=d?d:'';while(qp){i=qp.indexOf(',');i=i<0?qp.l" |
Oh, yeah - that's a page that I'm working on today. It will be gone by tomorrow. |
I was recently working with a client trying to implement a Content Security Policy (CSP) on their webpage. One of the first policies we added was to disallow
unsafe-eval
code. We soon ran into CSP violations caused by Adobe analytics plugins' obfuscated code.As an example, here's the implementation of
getPreviousValue
I'm not sure what the reasoning is for the obfuscated code as it doesn't seem like something which should be a secret. Using
new Function
also limits the effectiveness of a CSP if users are allowingunsafe-eval
.I would suggest at the very least changing plugin snippets to not use
eval
. Here would be an equivalent for thes.split
definition without usingeval
.relates to #17
The text was updated successfully, but these errors were encountered: